Carriers such as aircraft or further ships have many navigation systems. Among these systems, a hybrid piece of INS/GNSS (Inertial Navigation System/Global Navigation Satellite System) equipment is notably included.
A central inertial unit provides not very noisy and short term accurate information. However, over the long term, the localization performances of a central inertial unit degrade (more or less rapidly depending on the quality of the sensors, accelerometers or gyroscopes for example, and on the processing operations used by the central unit). If pieces of information acquired from a satellite navigation system, as for them, are not very likely to drift over the long term, they are however often noisy and with variable accuracy. Moreover, inertial measurements are always available whereas GNSS information is not always available or is likely to be decoyed and scrambled.
Hybridization consists of combining the pieces of information provided by the central inertial unit and the measurements provided by the satellite navigation system in order to obtain position and speed information by benefiting from both systems. Thus, the accuracy of the measurement provided by the GNSS receiver allows the inertial drift to be controlled and the not very noisy inertial measurements give the possibility of filtering the noise on the measurements of the GNSS receiver.
The model of GNSS measurements, which is known, does not take into account possible satellite failures which affect the clocks or the transmitted ephemerides, these failures being generally apparent in the form of biases or drifts on the GNSS measurements.
Within this scope, integrity checking systems have the purpose of detecting the occurrence of these failures and of excluding the responsible satellites in order to again find a navigation solution no longer containing any non-detected error.
In INS/GNSS hybrid navigation systems, the probability of failure of two satellites in a same constellation is less than the risk of integrity. This event may then be ascribed to the risk of integrity and the system only requires a capability of detecting a single satellite failure. The satellite identified as having failed may then be excluded so as to suppress pollution of the navigation state by the satellite failure.
The multiplication of the satellite constellations dedicated to navigation (GPS, Galileo, Glonass for example) increases the number of satellites which may be used in an INS/GNSS hybrid navigation system. But then the probability of encountering two simultaneous satellite failures will no longer be negligible against the risk of integrity.
Thus, future navigation systems, which will demand higher integrity requirements, will be forced to have capability of detecting and of excluding more than one satellite failure.
Now, present integrity checking techniques only allow detection of a single satellite failure, and these techniques cannot be extended to the double failure case without requiring high computational load.
The article “A GLR Algorithm to Detect and Exclude up to Two Simultaneous Range Failures in a GPS/Galileo/IRS Case” of A. Gerimus and A. C. Escher, ION GNSS 2007, discusses the use of a method for detecting and excluding multiple satellite failures based on the GLR (Generalized Likelihood Ratio) algorithm for detecting two satellite failures. A main drawback of this method lies in the fact that it only uses a single navigation filter and that it will begin by detecting the satellite which has the most significant failure before being able to detect the second faulty satellite, consequently significant errors will be observed on the navigation solution. Further, this method does not give the possibility of suppressing pollution of the navigation state by the first satellite failure, which necessarily impacts the capability of the system of detecting the second satellite failure.